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^j. (57) Abstract: The invention relates to password-based authentication in group networks. Each device (42) has an authentication 
^5 token irreversibly based on the password. The authentication involves a first device (42-1) at which the password P is entered and 
O a second device (42-2) towards which the authentication occurs. The first device determines a check token Mj for the second based 
^ on the password and its own authentication token Riand this check token is sent to the second device, where it is compared with the 
Q athentication token of that device. The procedure may include update of a device to exclude a non-trusted device from the group or 

change the password. Advantageous features are that the information in one device does not allow retrieval of the password and that 

the password is only exposed at one device, and only temporarily, during the authentication. 
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TECHNICAL FIELD 



5 The present invention generally relates to security in communication 
systems and in particular to password-based authentication in group 



In recent years, there has been an increasing interest in dynamical group 
networks referred to as ad-hoc networks, which basically can form wherever 
two or more nodes using the same means to communicate are present. Every 
node in the network can act as a router forwarding packets for other nodes 

15 or there is only broadcast communication. Hence, ad hoc networks do not 
need a centralized control organ and can very quickly be formed, merged 
together and partitioned into separate networks on the fly, without relying on 
a fixed infrastructure. An advantageous feature of such networks is that 
comparatively small and simple devices can be used as nodes, including 

20 Personal Digital Assistants (PDA), laptops and cellular phones. Wireless 
communication is generally used to interconnect at least some devices, but 
the network may also include static and wired nodes. 

Ad hoc networks can comprise Local Area Networks (LAN), such as 
25 workstations in the same building interconnected to share the resources of a 
server, as well as group networks managed by individual persons, commonly 
referred to as Personal Area Networks (PAN). A PAN is generally associated 
with a small coverage and consists of networked personal devices in close 
vicinity of the owner. Typical PAN nodes are PDAs, printers, personal 
30 computers, digital cameras, mobile phones and MP3 players, but the 
network may also include household appliances such as refrigerators and 
vacuum cleaners. Ad hoc communication in a PAN can use various 
technologies. The Bluetooth technology, for example, may often be an 
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appropriate choice for wireless communication between mobile devices in a 
PAN. 

Interconnecting personal devices into group networks leads to some obvious 
5 advantages. Nevertheless, it lies in the nature of such networks that they are 
very vulnerable to attacks by unauthorized intruders. A main reason for this 
is that the communication often uses radio frequencies and is therefore easy 
to eavesdrop on. Moreover, portable devices are naturally easier to steal. 
Finally, if countermeasures are not taken, the ad-hoc nature implies a high 

10 risk of a rogue device entering the network. The consequences may for 
instance be devastating if a malicious intruder is passed as a member of the 
group and allowed to send instructions to the other group members and get 
access to secret information stored therein. Well- functioning security 
solutions are hence crucial for group networks like PANs to become widely 

15 spread in the future. In particular, there is a need for secure mechanisms for 
excluding non-trusted group members, e.g. by revoking the privileges of 
stolen devices. 

In a PAN, a normal everyday user is the manager of the group and user 
20 convenience is highly prioritized. A most desirable feature of PAN security 
mechanisms, such as mechanisms for user authentication and for 
revocation of group members, is therefore that they are user-friendly, 
preferably based on simple user passwords. 

25 According to a well-known prior-art method for password-based authen- 
tication towards a device, the "hash value" of the password is stored in the 
device. When a password is input to the device, the corresponding hash 
value is determined. The device then compares this hash value with the 
locally stored value, which are to be identical if the input password is 

30 correct. Typically, the user immediately gets some kind of indication of 
whether the authentication succeeded. 
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The described method can be applied onto a group network, generally using 
one common password for all group members in order to achieve simple 
network management. However, this solution is associated with severe 
drawbacks, since anyone hacking a group member is able to retrieve the 
5 locally stored hash value and use it to guess and verify the correct password. 
Since passwords tend to be rather short, e.g. four digits/characters, it is 
often feasible to try all possible passwords in an automated attack. This 
illustrates a major problem of conventional password-based mechanisms, 
i.e. that the password generally can be "reverse-engineered" by means of the 
10 information stored in a stolen device. 

Accordingly, the authentication mechanisms of conventional tele- 
communication systems are far from satisfactory and there is a considerable 
need for an improved procedure for password-based authentication of group 
15 members. 

SUMMARY 

A general object of the present invention is to provide an improved security 
20 solution for group networks. A specific object is to provide an improved 
mechanism for password-based authentication of group members. Another 
object is to achieve secure revocation of group members. 

These objects are achieved in accordance with the attached claims. 

25 

Briefly, a new way of performing password -based authentication of devices in 
group networks, such as ad hoc networks and PANs, is proposed. Each 
group member is provided with an authentication token, which is created by 
means of the password but nevertheless cannot be used to recreate the 
30 password nor to verify that a password guess is correct. This can for example 
be achieved by using a bijective locking function to which a common secret 
and a one-way function of the password are input. The authentication 
involves two devices, a first device to which the password is input and a 
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second device towards which the authentication occurs. The first device 
determines a check token for the second based on the identity of that device, 
the password and its own authentication token. This check token is 
transferred to the second device, where it is compared with the 
5 authentication token thereof. If these tokens match, the input password is 
correct and the authentication succeeds. 

Preferably, the password as well as all significant parameters generated in 
the process except the authentication token of each device are erased after 
10 usage. In this way, the information contained in one device does not permit 
retrieval of the password, which results in a high level of security. Another 
major advantage offered by the invention is that the password only has to be 
temporary exposed at one single device during an authentication event. 

15 A preferred embodiment of the invention includes update of a device and can 
be used, among other things, for revocation of a non-trusted device or for 
changing the password. It is even possible to exclude a group member 
without changing the password, which is often convenient for the user. 
Other embodiments of the invention achieve secure delegation of update 

20 rights as well as mutual (bilateral) authentication between group members. 
Furthermore, policies limiting the number or frequency of authentication 
attempts are preferably implemented, in particular if the authentication 
response is communicated back to the user. 

25 According to other aspects of the invention a communication system and a 
device with means for password-based authentication, as well as a computer 
program product for password-based authentication are provided. 
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BRIEF DESCRIPTION OF THE DRAWINGS 

The invention, together with further objects and advantages thereof, is best 
understood by reference to the following description and the accompanying 
drawings, in which: 

Fig. 1 is a schematic view of an exemplary group network in which the 
present invention can be used; 

Fig. 2 is a schematic view of the basic components of a group network 
according to an exemplary embodiment of the present invention; 

Fig. 3 illustrates authentication towards a group member according to an 
exemplary embodiment of the present invention; 

Fig. 4 illustrates authentication and update according to a preferred 
embodiment of the present invention; 

Fig. 5 illustrates authentication and update in a group network according 
to a preferred embodiment of the present invention; 

Fig. 6 is a flow chart of a preferred embodiment of the authentication 
method according to the present invention; 

Fig. 7 illustrates an initial set-up procedure for forming a group network 
according to an exemplary embodiment of the present invention; 

Fig. 8 illustrates addition of a new member to a group network according 
to an exemplary embodiment of the present invention; and 

Fig. 9 illustrates delegation of update rights in accordance with an 
exemplary embodiment of the invention. 



t 
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DETAILED DESCRIPTION 

Throughout the drawings the same reference numbers are used for similar 
or corresponding elements. 

5 

Fig. 1 is a schematic view of an exemplary group network in which the 
present invention can be used. A rather small network 100 is shown, 
consisting of a PDA 12-1, a laptop 12-2 and a cell phone 12-3, forming a so- 
called Wireless Personal Area Network (WPAN). Other personal devices may 

10 be included in the PAN, such as printers, MP3-players, digital cameras and 
various household appliances (refrigerators, vacuum cleaners, etc). In fact, 
the invention is not limited to PANs, but can be used in any kind of group 
network including other groups connected in an ad hoc fashion. A typical 
feature of such an ad hoc network is that some devices are part of the 

15 network only during a communication session or while in close proximity to 
the rest of the network. 

The group network in accordance with the invention includes at least two 
nodes associated with a common password, e.g. a PIN-code. The group is 
20 generally managed by a single user, but there may be cases where two or 
more users, e.g. members of the same household, share a password. The 
nodes can be interconnected by wireless connections as in Fig. 1, e.g. using 
Bluetooth or Infrared technology, or cable connections and combined 
wireless/ wired networks are common. 

25 

Fig. 2 is a schematic view of the basic components of an exemplary group 
network in accordance with the invention. A network composed of four 
devices/units 22 with separate identities IDi, i=l,..,4, and handled by a user 
23 is illustrated. Each device has been provided with an identical group key 
30 Kg for secure communication within the group, using well-known 
conventional authentication techniques. This key is primarily intended to be 
used when the devices communicate with a minimum of user-interaction, 
e.g. when they need to automatically connect to each other. By means of Kg 
the devices can verify that they belong to the same group network. There 
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may also be individual key pairs Kij (not shown), i=l,..,4 and j B l,..,4, to 
enable secure communication between two specific members of the group. 
The keys Kg and Kij are typically installed in the devices during set- 
up/initial handshake procedures. The user has a password P for managing 
5 the group network. All devices of the group are thus associated with the 
same password P. 

Besides authentication occurring "automatically" between devices, the user 
in some cases need to authenticate himself to a particular device. In order to 

10 achieve password-based user authentication in accordance with the 
invention, each device in the group has a unique authentication token Ri 
(i=l,..,4 in Fig 2). Typically, each authentication token Ri is stored in the 
corresponding device, preferably tamper-resistantly protected, but there may 
also be cases where one or more Ri are externally stored, for example at a 

15 secure server from which they are retrieved when needed for authentication 
purposes. The authentication tokens are assigned such that no individual 
authentication token alone permits retrieval of the password nor provides 
means to verify that a guessed password is correct. Preferably, the 
authentication token should not reveal any information on the password at 

2 0 all. Ri is thus a one-way function of the password P and preferably also 
depends on a token secret S, which is a basic group key/ secret individually 
uncorrelated both with the password P and with the authentication token Ri. 
Each authentication token Ri is then created from the same token secret S 
and the password P in a way that will be described later with reference to 

25 Figs. 7 and 8. Now a brief explanation of the relationship between Ri, S and P 
according to a preferred embodiment of the invention follows. 

The authentication token Ri (i=l,2,..,n for a group of n devices) is the result 
of a locking function E of Hi and the token secret S: 
30 Ri = E (Hi, S) 

Hi is in turn given by the expression: 
Hi = f (IDi || P) 
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i.e. a one-way function f of the password P and of the respective device 
identity IDi. || indicates string concatenation. 

The locking function E is a bijective function in the second input with an 
5 inverse function denoted D (D = E' 1 ), which implies that the token secret S 
may be unlocked through: 
S = D (Hi, Ri). 

The described relationships can be used for secure password-based 
10 authentication in accordance with the present invention. 

Password-based authentication 

Fig. 3 illustrates authentication towards a group member according to an 
exemplary embodiment of the present invention. The basic idea of the 

15 invention relies on using one device in the group for authentication towards 
one or more other group members. In the illustrated example, the user 33 
wishes to perform actions towards device j 32-2, such as sending revocation 
instructions, for which his explicit authorization needs to be verified. The 
user chooses another member of the group network, device i 32-1, to handle 

20 the authentication and inputs a password P at this device. Device i then 
uses a combination of its own authentication token Ri and the password to 
unlock the token secret S according to the following steps: 

i) Hi = f (IDi || P) 

ii) S = D (Hi, Ri) 

25 

Thereafter, device i uses S and P to create a check token Mj for device j: 

iii) Hj - f (IDj || P) 

iv) Mj = E (Hj, S) 

3 0 The check token Mj represents the authentication token that should be 
available at device j if the user has input the correct password. Mj is sent to 
device j, preferably protected by means of the key pair Kij, where it is 
compared with the actual authentication token Rj of device j. If Mj equals Rj 
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the authentication is successfully completed and the user can be trusted by 
device j. Should, on the other hand, Mj be different from Rj, the 
authentication fails and device j does not listen to instructions from device i 
that require explicit user authorization. It could, however, still accept other 
5 types of messages. In some cases, it may be appropriate to let device j 32-2 
communicate the result of the authentication comparison to device i 32- 1 by 
sending an authentication response message 34, as indicated by the dashed 
arrow in Fig. 3. 

10 The described procedure may with advantage be used for authentication 
with one device i towards several devices in the group, or even all other 
group members. The steps iii and iv above are then repeated for each device j 
(j=l,...,n and j*i). 

15 The only strict requirement on the assigning device i is that it must have an 
input unit or the like, e.g. a keyboard, for receiving the password. Since 
configuration actions could be called for anytime and anywhere, they should 
preferably be possible to invoke from any device belonging to the group. In a 
preferred embodiment of the invention each group member is therefore 

20 provided with a simple input unit, making it capable of acting as 
authenticator like device i above. 

The password P and S should preferably be erased as soon as possible after 
usage thereof, whereby they are only temporary exposed at device i. In a 
2 5 most preferred embodiment, all parameters participating in the 
authentication procedure, including P, S and intermediates like Hi, are 
deleted when no longer needed, except the respective authentication tokens 
Ri. 

30 The password-based authentication of the invention results in some major 
advantages. The password only needs to be exposed at one device in the 
group during the authentication procedure. This implies a considerably 
improved password management and security compared to conventional 
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authentication where the password is exposed at each unit. Moreover, the 
information of a single group member, i.e. its authentication token, does not 
allow retrieval or brute force search of the password. This means that it is 
not possible to obtain the password from a single stolen device by using the 
5 information therein. Neither can one device be used to "fool" another device 
without knowledge of the password. 

Authentication and update 

The purpose of the authentication is generally to send update information, 
10 such as revocation information or a new password, to one or several group 
members. In such a case, an updating procedure is integrated into the 
authentication procedure in a way illustrated by Figs. 4 and 5. 

Fig. 4 illustrates authentication towards and update of a device j 42-2 with a 
15 device i 42-1 according to a preferred embodiment of the invention. As 
before, the user 43 enters the password P of the group network at device i. If 
the user wants to change the password and /or exclude one or several 
devices from the group, a new password P and/ or revocation information 45, 
e.g. a list of non-trusted devices, are also input to device i. The token secret 

2 0 S is determined at device i through steps i and ii above. However, in this 

case some additional preparations are needed before the actual 
authentication and updating phases. First, a new token secret S' is created, 
preferably by conventional random value generating means. S' and P are 
then used at device i to create a new authentication token Ri' for itself 
25 according to: 

v) W = f (IDi || P) 

vi) Ri' = E (Hi', S') 

The authentication token Ri stored in device i (or externally) is replaced with 

3 0 the new authentication token Ri*. 
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The check token Mj for the authentication is created according to steps iii 
and iv above but this time a new authentication token Rj' for device j is 
determined as well: 
vii) Hj' = f(IDj||F) 
5 viii) Rj' = E (Hi 1 , S') 

Thereafter, the check token Mj is transferred from device i to device j, where 
the authentication comparison between Mj and Rj is performed in the above- 
described way. The authentication response message 44 sent from device j in 
10 Fig. 4 to indicate the result of the authentication is optional. Only if the 
tokens match and the authentication thus is successful, device j agrees on 
being updated by device i. In such a case, update information can be 
successfully transferred to device j. The key par Kij or another a security 
mechanism is preferably employed also for this transfer of information. 

15 The update information for device j comprises the new authentication token 
Rj' and possibly also revocation information and/or a new group key Kg'. The 
revocation information is preferably protected and may include a revocation 
list containing the devices to be excluded or an equivalent group-defining list 
of the devices still being part of the group. Through such a list the device j 

20 can be instructed to ignore a non-trusted device. Moreover, the list can be 
especially useful during a period of time in the update when some trusted 
devices have not yet been updated with the new group key Kg', and the fact 
that a device can prove possession of a particular group key is thus not 
sufficient to distinguish between trusted and non-trusted devices. The new 

25 group key Kg' is typically included in the update information if the update is 
related to group-defining measures, such as revocation. 

The described procedure may with advantage be used in order to change the 
password P, exclude a non-trusted member from the group, or achieve both 
30 a password change and revocation at the same time. If the user does not 
wish to change the password, P' is equal to P in the above equations. The 
fact that the invention enables revocation of a device without changing the 
password constitutes another advantageous feature thereof. The user is 
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spared the trouble of having to invent and remember a new password every 
time the group network is redefined, which simplifies the management of the 
group. 

5 Fig. 5 visualizes authentication and update in a group network according to 
an exemplary embodiment of the invention. In the illustrated example, the 
group manager 53 uses the device 52-2 with identity ID2 for authentication 
and update towards the other devices 52-1, 52-3, 52-4 by means of the 
above-described mechanism. The passwords P, F and revocation information 

10 55 are thus entered at device 52-2, which repeats the steps iii, iv, vii and viii 
for each device j (j=l, 3, 4) to obtain the respective check tokens and update 
information. The new password F is like the previous password P only 
exposed at device 52-2 and together with all parameters except the new 
authentication tokens Ri' (i=l, 2, 3, 4) preferably deleted immediately after 

15 usage. 

Generally, the update procedure is initiated by the group manager in the 
above-described way. Solutions where one device in the group network 
initiates update by sending a request to another device also lie within the 
20 scope of the invention. In one embodiment, a unit that is switched-on after an 
inactive period for example automatically asks for appropriate update 
information from at least two other units. 

Fig. 6 is a flow chart of a preferred embodiment of the authentication method 
25 according to the invention with integrated update. Initially, all units in the 
group network sire provided with a respective authentication token in step 
SL The assignment of authentication tokens involves using the password P 
of the group but this is accomplished such that no individual authentication 
token alone can be used to recreate the password. When the group members 
30 have received their authentication tokens in this assigning phase, the actual 
authentication phase can be initiated by entering the password at a first unit 
chosen by the user. The first unit determines a check token for a second 
unit, more specifically the unit towards which authentication is needed, in 
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step S2. The check token is securely transferred to the second unit, where it 
is compared with the authentication token assigned to this unit (step S3). 
The requirement for a successful authentication is that these tokens match 
completely. Should this not be the case, the authentication fails (step S4) 
5 and the second unit will not trust the manager of the first unit. 

Identical tokens, on the other hand, means that the input password is 
successfully verified. In this case, the second unit accepts being updated by 
the first unit. Update information, including a new authentication token for 

10 the second unit, is then created at the first unit in step S5. In step S6, the 
generated update information is transferred to the second unit, possibly 
together with update information that is forwarded unchanged by the first 
unit. This transfer could be initiated in response to an authentication 
response message sent from the second unit. Alternatively, step S5 and 

15 possibly also S6 is performed at an earlier stage before the comparison in 
step S3. Step S5 can for example be simultaneous with the check token 
determination in step S2. Either way, a successful authentication 
comparison is always required for the second unit to accept being updated 
by the first unit. In a final step S7, all parameters used in the authentication 

20 process but the authentication tokens are erased from the group network, 
including the password. 

The described mechanism for password-based authentication can be realized 
as a computer program product implemented in the group network. The 
25 computer program product could for example be an executable software 
module comprising program means for performing the steps of Fig. 6. 

The main principles of the invention have now been explained, and the 
following paragraphs will be devoted to specific features and embodiments 
30 thereof. 
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Assigning authentication tokens 

Before the actual authentication phase, authentication tokens Ri (i=l,2,...,n 
for a group of n devices) have to be assigned to all devices in the group. 

5 In an initial set-up phase, for instance when a new group network is formed, 
the authentication tokens Ri, and preferably also the group key Kg, are 
spread throughout the system. Referring to Fig. 7, one of the devices 72-1 is 
hereby selected to act as an "assigning device", creating its own 
authentication token as well as the authentication tokens for all other 

10 devices 72-2, 72-3. The assigning procedure normally starts when the user 
73 enters the password P to the assigning device 72-1. This device generates 
a token secret S for the group, preferably using a random value generating 
function. For each other device 72-2, 72-3, device 72-1 then calculates an 
authentication token according to the following steps (j=2,3): 

15 ix) Hj = f(IDj||P) 

x) Rj = E(Hj, S) 

In a preferred embodiment, the authentication tokens R2, R3 are sent to the 
corresponding devices over secure connections, such as by using the pair 

20 keys Ki,2, Ki,3, and tamper-resistantly stored therein. However, in some 
cases these keys Kij are not available at the initial set up. Then, the devices 
preferably communicate by wire, Infrared or short-range wireless links 
during the initial phase to make eavesdropping difficult. This initial phase 
could include establishment of said keys. Alternatively, keys are manually 

25 entered to devices by the user/ administrator. 

When adding a new device to an already existing group network, a similar 
assigning procedure may be used, as illustrated in Fig. 8. Assume that the 
user 83 wants to add a new device 82-4 to the group network. He then 
30 inputs the password P to another device 82-2, which is already a member of 
the group and associated with an authentication token R2. This 
authentication token R2 is together with P and ID2 used to unlock S and 
calculate R4 at device 82-2 according to the following steps (i=2, j=4): 
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xi) Hi = f (IDi || P) 

xii) S = D(Hi, Ri) 

xiii) Hj = f (IDj || P) 

xiv) Rj - E (Hj, S) 

5 

R4 is with advantage securely sent from device 82-2 to device 82-4 using the 
key pair K2.4. It should be emphasized that the user can select any suitable 
device 82-1, 82-2, 82-3 in the group to assign an authentication token for a 
new device. In particular, this assigning device 82-2 does not have to be 
10 identical to the assigning device (72-1 in Fig. 7) performing the initial 
authentication token spreading. 

Again, all parameters participating in the assigning procedure except the 
authentication tokens are preferably erased after usage. 

15 

The locking function E 

The locking function E used to determine the authentication tokens Ri can 
be implemented in different ways in accordance with the invention. However, 
in order to retrieve S in the above-described assigning and authentication 
20 phases, E must be bijective in the second input, i.e. possible to convert into 
the inverse "unlocking" function D. 

In a preferred embodiment the locking function E is a symmetric block 
encryption function, such as a well-known prior-art function like DES, AES, 
25 Blowfish or a simple bitwise XOR. Other embodiments can be based on 
asymmetric functions instead, for example ElGamal encryption: 

E(x, y) = g x y mod p 

< 

D(x, y) = g" x y mod p 

where p is an appropriate prime number and g is a generator of a large sub- 
group of Zp\ More information on the mentioned encryption functions as well 
30 as on general cryptography can for instance be found in "Handbook of Applied 
Cryptography" by A.J. Menezes, P.C. van Oorschot and S.C. Vanstone, CRC 
Press. 
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The basic property exploited in the locking function is that for each possible 
password F there exists an S' which, if P is correct, would have produced 
the authentication token Ri. Hence, it is not possible to use Ri as a "witness" 
5 for a correctly guessed password. More precisely, given a candidate P, it can 
easily be verified that the value S' = D(f (IDi || P), Ri) has this property, since 
E(f (IDi || P), S') = Ri. 

Another approach, generalizing the above methods, is to use a new 
10 interpolation method referred to as password-based secret sharing. The 
locking function is then set as 

E(x, S) = ax + S (a *0) 
which corresponds to straight lines with slope a and intercepts S. Still 
referring to the line interpretation of the locking function, the basic idea is to 
15 share the secret to the line (i.e. to E) between the respective device and the 
user in the sense that each possesses a vital piece of information needed for 
determination thereof. Since a straight line is uniquely determined by two 
points, the secret sharing can be achieved by providing information of one 
point on the line in the device (through Ri), whereas the user password P is 
20 needed to obtain the other point. 

The outlined password-based secret sharing may be accomplished in the 
following way. E(Hi, S) is created for each i and the respective authentication 
tokens Ri are set as: 

25 Ri = { x, E(x, S), E(Hi, S) } (x * Hi) 

where x is a random value equal for all Ri in the group. In this case, Ri 
contains both coordinates (x, E(x, S)) of one point on the "line" E but only 
one coordinate (E(Hi, S)) of the other point. The remaining coordinate (Hi) can 
only be determined by entering the password P at device i, since it is by 

30 definition a one-way function of P: 
Hi = f (IDi || P) 

The unlocking is in this example achieved through interpolation with the 
decryption function D defined as: 
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D(H it R i ) = E(x,S)-x. E(x ' S J-^ S) 

By using the above equation, the token secret S can be retrieved provided 
that P (and thus Hi) is known. 

5 Delegation of update rights 

If a user starts performing an update with a certain device and for some 
reason cannot continue although there are still devices left to update, it may 
be appropriate to apply a delegation scheme in accordance with another 
embodiment of the invention. The user then selects one or more group 
10 members that are authorized to update the remaining devices. This means 
that the update occurs via an intermediate device that has received update 
rights from the original updating device to which the password P was input. 

Fig. 9 schematically illustrates an exemplary embodiment of the invention 
15 where update rights are delegated from device i 92-1 to two intermediate 
devices ql and q2 92-2, 92-3. Device i creates the check token Mj and the 
new authentication token Rj* for a non-updated device j 92-4 in accordance 
with steps iii, iv, vii and viii above. It sends Mj and update information 
comprising Rj' to both intermediate devices ql and q2. In the illustrated 

2 0 example, device q2 has encountered the non-updated device j and forwards 

the update information to this device after a successful authentication. 

In order to increase the possibility of a quick and reliable update of the 
remaining devices, it may thus be appropriate to delegate equivalent update 
25 rights to several intermediate devices. The device that first is able to 
communicate with a specific non-updated device, performs the update 
thereof. The scenario that another update-authorized device later encounters 
this already updated device, can be handled in different ways. One 
possibility is that an updated device is instructed to ignore multiple update 

3 0 attempts. Another is that the update-authorized device recognizes that there 

has already been an update and that no further action is needed. Means for 
achieving this will be described in the following. A final way of dealing with 
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multiple update attempts would be to simply allow them. This leads to 
unnecessary signaling in the network but will generally not cause any 
significant problems. 

In the proposed delegation scheme the update information is still created at 
the original updating device (92-1 in Fig. 9) although at least a portion 
thereof is transferred via the intermediate device(s). Consequently, the 
password P still only needs to be exposed at one group member. This 
constitutes yet another advantageous feature of the invention, and enables 
embodiments where the delegation of update rights includes delegation of 
rights to further delegate the update rights. In other words, the update can 
occur through two or more intermediate devices, resulting in a chain of 
group members participating in the updating process. Irrespective of the 
number of intermediate devices, the password P is restricted to the first 
device and in this regard the secure password management of the invention 
is maintained. 

Irrespective of whether the delegation involves a single intermediate device or 
several devices, the update rights may with advantage be accompanied by a 
time stamp in accordance with a further embodiment of the invention. The 
time stamp facilitates determining of whether the update information is still 
valid at the point of time when the intermediate device actually encounters 
one of the devices concerned by the update rights. Preferably, the time stamp 
comprises a generation identity IDg, indicating to which update generation 
the update information belongs. For comparison purposes, the devices in the 
group also have IDg parameters. During an ongoing update process some 
devices could for instance be updated with a new generation identity IDg, 
while others are still associated with the previous IDg. The generation 
identities IDg of the devices are generally closely related to and updated at 
the same time as the group key Kg. 

By means of the time stamp, a device q encountering a device j for which it 
has update information can determine if an update is still of interest by 
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checking whether the update information belongs to a later generation than 
the current generation identity IDg of device j. By keeping track of different 
update events in the described manner, delayed update events can be 
recognized and ignored. 

5 

Preferably, the delegation of update rights involves an active choice by the 
user regarding which group members that should have the right to perform 
update actions, as described above. However, the invention also covers 
solutions where the original updating device automatically initiates the 
10 delegation in response to a failed or interrupted update process. 

Authentication response message and update policies 

In accordance with the basic principles of the invention, a user enters a 
password to a device that verifies it with another device. The first device does 

15 not know the outcome of the authentication and nor does the user. In some 
cases an accept/ reject signal may be desired and in accordance with some 
embodiments of the invention an authentication response message (34; 44; 
94 of Figs. 3, 4 and 9) is therefore sent back to the first device to indicate the 
authentication result. In case of failure it can also be appropriate to generate 

2 0 an error audit log message. 

The advantage of the authentication response message is that it makes it 
possible for the user to see whether he entered the correct password. 
However, sending a response message also introduces a problem, since it 

2 5 practically immediately reveals if a password tried by an attacker at a stolen 

device is correct or not. It would thus be possible for the attacker to try 
many different passwords by repeatedly sending information to several non- 
updates devices. To avoid this, policies regulating the authentication are 
preferably implemented in some or all devices in the group network. These 

3 0 policies may for instance impose a limit on the number on password 

attempts. Each device could e.g. be instructed to only accept three 
subsequent password attempts. 
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There may also be policies focusing on the frequency of the password 
attempts, such that the response message displayed to the user is 
exponentially delayed as the number of password attempts increases. An 
attacker then has to wait longer and longer for the result of each password 
5 attempt, making it practically impossible to carry through with the large 
number of attempts that statistically would be needed to find the correct 
password. Such delay policies are preferably combined with a limit on the 
number of password attempts but could also be separately applied. 

10 According to other embodiments of the invention, an alarm signal for the 
user is generated if a predetermined number of password attempts is 
exceeded. The alarm signal is created at the attacked unit and preferably 
sent to one or several other group members as soon as appropriate 
communication paths can be established. When the alarm message reaches 

15 the group manager he can take appropriate measures, such as initiating a 
revocation, in response thereto. 

Mutual authentication 

Another advantageous feature of the proposed method is that it can be 
2 0 extended to allow two-way authentication, where not only a first device is 
authenticated towards a second device but the second device is at the same 
time authenticated towards the first device. By means of this mutual 
authentication a trust relationship is established between a pair of devices in 
the group network. 

25 

Two exemplary implementations of a mechanism for mutual authentication 
between a device i and a device j in accordance with the invention are given 
in Protocol A and B below. Both solutions involves additional security 
measures to protect the authentication token Rj and involves temporary test 
30 secrets that are based on random values generated at the respective unit. 
This results in authentication comparisons between parameters representing 
the authentication tokens, i.e. between indirect authentication tokens. The 
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communication between device i and j below is preferably protected by 
means of the key pair Kij. 



Protocol A 

5 Define f(R, z) as an appropriate pseudo-random function, e.g. AES with key R and 
input z, and let \\ denote concatenation of bit strings. 

Device i Device j 

Enter password P 
10 Calculate Mj 

Create random value x 

x > 

Create random value y 
Seta'=f(Rj,x\\y\\IDi) 
15 Setb=m,y\\x\\IDj) 

« y> a' 

Seta=f(M J}X \\y\\IDi) 
Check if a' = a 
Ifso,setb'=f(Mj,y\\x\\IDj) 
20 b' > 

Check if b'^b 

If so, mutual authentication OK 



2 5 Protocol B 

Define p as an appropriate prime number and g as a generator of Zp and let || denote 
concatenation of bit strings. 

Device i Device i 

3 0 Enter password P 

Calculate Mj 

Create random value x 

Set a = Mjg* mod p 

a > 

3 5 Create random value y 

Set Z' = (a/Rj)y mod p 
Set b = Rjgy mod p 

Set c = HMAC(Z' mod p,a\\b \\ IDj \\ txtl) 
<■ b,c,txtl 

40 Set Z = (b/M)f mod p 

Calculate c'= HMAC (Z mod p,a\\b || IDj \\ txtl) 
Check ifc = c' 

If so, set d = HMAC (Z mod p,a\\b \\ ZD. || txt2) 
d,txt2 » 

4 5 Calculate d' = HMAC (Z' mod p, a \\ b \\ ID \\ txt2) 

Check ifd = d' 

If so, mutual authentication OK 
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The solution in Protocol A has the advantage of being very straight- forward. 
Nevertheless, it theoretically leads to a somewhat reduced password 
security, since extensive guessing might lead to the password. In practice, 
this normally does not constitute a problem, and in case of concern an 
5 encryption encapsulated Protocol A can be used. 

In Protocol B, the authentication tokens are hidden through additional 
security steps. The procedure is based on exchanging a key g** common for 
the two devices and determined by one random value from each device, x 
10 and y. The key exchange occurs through transfer of the parameters a and b. 
txtl and txt2 are text strings of arbitrary length concatenated with a and b 
to form the second input parameter of the one-way function HMAC. For 
further information on HMAC, reference is made to IETF: M HMAC, Keyed- 
Hashing for Message Authentication" (RFC 2104). 

15 

Critical operations 

It may in some cases be appropriate to distinguish between critical 
operations, for which user authentication is required, and other less 
important operations in the group network. For this purpose, a preferred 
20 embodiment of the invention implements policies defining critical operations 
at some or all units in the group. One way would be to simply use a look-up 
table accessed from the units. The policies are stored either at the units or 
externally. 

2 5 The critical operations comprise both operations requiring update of some 
devices in the group, such as revocation, and operations that do not involve 
information update but still require authentication. The latter typically holds 
for operations performed in order to access objects or services associated 
with high security demands, such as opening a safe or retrieving secret 

30 information from a server. 

Although the invention has been described with reference to specific 
illustrated embodiments, it should be emphasized that it also covers 
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equivalents to the disclosed features, as well as modifications and variants 
obvious to a man skilled in the art. Thus, the scope of the invention is only 
limited by the enclosed claims. 
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CLAIMS 

L A method for password-based authentication in a communication system 
comprising a group (100) of at least two units (12; 22; 32; 42; 52; 72; 82; 92) 
5 associated with a common password, characterized by the steps of 

assigning individual authentication tokens to the respective units in the 
group based on the password such that each authentication token is 
irreversibly determined by the password; 

determining, at a first unit (32-1; 42-1; 52-2; 92-1), a check token for a 
10 second unit (32-2; 42-2; 52-1, 52-3, 52-4; 92-4) based on the password and 
the authentication token of the first unit; and 

comparing, at the second unit, the check token with the authentication 
token of the second unit for authentication of the first unit towards the second 
unit. 

15 

2. The method of claim 1, characterized by the further step of 

deleting the password and all significant parameters generated in the 
authentication procedure except the authentication tokens after usage thereof. 

20 3. The method of claim 1, characterized by the further step of 

accepting, at the second unit (42-2; 52-1, 52-3, 52-4; 92-4) and in 
response to a successful authentication, update information securely 
transferred from the first unit (42-1; 52-2; 92-1), at least a portion of the 
update information being created at the first unit. 

2 5, 

4. The method of claim 3, characterized in that the update information is 
associated with revocation of a non-trusted group member. 

5. The method of claim 3, characterized in that the update information 

3 0 relates to a password change. 



6. The method of claim 3, characterized in that the update information is 
selected from the group of: new authentication tokens, a new group key, a 
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group-defining list, and a revocation list (45; 55; 95), including combinations 
thereof. 

7. The method of claim 3, characterized by delegation of update rights to a 
5 third intermediate unit (92-2, 92-3), and sending at least a portion of the 

update information for the second unit (92-4) to the intermediate unit. 

8. The method of claim 7, characterized in that the update information is 
accompanied by a time stamp for determining whether the update information 

10 is still valid when the intermediate unit (92-2, 92-3) encounters the second 
unit (92-4). 

9. The method of claim 7, characterized in that the delegation of update 
rights comprises delegation of rights to further delegate update rights. 

15 

10. The method of claim 1, characterized in that the assigning step in turn 
comprises the steps of 

determining, at an assigning unit (72-1; 82-2) in the group, a token secret 
common for the group and non-correlated with the password; and 

2 0 creating, at the assigning unit, the authentication token for another unit 

(72-2, 72-3; 82-4) in the group based on the token secret and the password. 

11. The method of claim 10, characterized in that the step of determining 
the token secret involves generating the token secret, as a part of an initial 

25 set-up procedure. 

12. The method of claim 1, characterized in that the step of determining the 
check token in turn comprises the steps of 

retrieving, at the first unit (32-1; 42-1; 52-2; 92-1), the token secret using 

3 0 the authentication token of the first unit and the password; and 

creating, at the first unit, the check token for the second unit (32-2; 42-2; 
52-1, 52-3, 52-4; 92-4) based on the token secret and the password. 
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13. The method of claim 10 or 12, characterized in that the creating step 
involves using a bijective locking function, the input parameters of which 
include the token secret and a one-way function of the password. 

5 14. The method of claim 13, characterized in that the locking function is a 
symmetric encryption function. 

15. The method of claim 13, characterized in that the locking function is 
implemented through password-based secret sharing. 

10 

16. The method of claim 1, characterized by implementing policies in at least 
one of the units in the group for limiting the number and/or frequency of 
authentication attempts. 

15 17, The method of claim 1, characterized by the further step of generating 
an alarm signal if the number of authentication attempts exceeds a 
predetermined value. 

18. The method of claim 1, characterized by the further step of sending an 
20 authentication response message (34; 44; 94) from the second unit (32-2; 42- 

2; 92-4) indicating the result of the comparing step. 

19. The method of claim 1, characterized by further authentication of the 
second unit (32-2; 42-2; 52-1, 52-3, 52-4; 92-4) towards the first unit (32-1; 

25 42-1; 52-2; 92-1), whereby the first and second units are mutually 
authenticated towards each other. 

20. The method of claim 19, characterized by the steps of: 
generating a respective random value at the first and second unit; 

30 determining temporary test secrets at the first and second unit based on 

the random values; and 

exchanging the temporary test secrets between the first and second unit 
for mutual authentication purposes. 
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21. The method of claim 1, characterized in that critical operations for 
which authentication is needed are listed in policies in at least one of the 
units (12; 22; 32; 42; 52; 72; 82; 92). 

5 

22. The method of claim 3, characterized in that a unit (42-2; 52-1, 52-3, 
52-4; 92-4) that is switched-on after being inactive for a predetermined period 
of time automatically requests appropriate update information from at least 
two other units. 

10 

23. The method of claim 1, characterized in that the group (100) of units 
constitutes a Personal Area Network (PAN). 

24. The method of claim 1, characterized in that the authentication tokens 
15 are tamper-resistantly stored in the respective units (12; 22; 32; 42; 52; 72; 

82; 92). 

25. A communication system including a group (100) of at least two units 
(12; 22; 32; 42; 52; 72; 82; 92) associated with a common password, and 

2 0 means for password-based authentication, characterized by 

means for assigning individual authentication tokens to the respective 

units in the group based on the password such that each authentication 

token is irreversibly determined by the password; 

means for determining, at a first unit (32-1; 42-1; 52-2; 92-1), a check 
25 token for a second unit (32-2; 42-2; 52-1, 52-3, 52-4; 92-4) based on the 

password and the authentication token of the first unit; and 

means for comparing, at the second unit, the check token with the 

authentication token of the second unit for authentication of the first unit 

towards the second unit. 

30 

26. The system of claim 25, characterized by further comprising 

means for deleting the password and parameters generated in the 
authentication procedure except the authentication tokens after usage thereof. 
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27. The system of claim 25, characterized by further comprising 

means for transferring update information from the first unit (42-1; 52- 
2; 92-1) to the second unit (42-2; 52-1, 52-3, 52-4; 92-4); and 

means for accepting, at the second unit, update information from the first 
unit in response to a successful authentication. 

28. The system of claim 27, characterized in that the update information is 
associated with revocation of a non-trusted group member. 

29. The system of claim 27, characterized in that the update information 
relates to a password change. 

30. The system of claim 27, characterized in that the update information is 
selected from the group of: new authentication tokens, a new group key, a 
group-defining list, and a revocation list (45; 55; 95), including combinations 
thereof. 

31. The system of claim 27, characterized by means for delegation of update 
rights to a third intermediate unit (92-2, 92-3), and means for sending at least 
a portion of the update information for the second unit (92-4) to the 
intermediate unit. 

32. The system of claim 25, characterized in that the means for assigning in 
turn comprises 

means for determining, at an assigning unit (72-1; 82-2) in the group, a 
token secret common for the group and non-correlated with the password; 
and 

means for creating, at the assigning unit, the authentication token for 
another unit (72-2, 72-3; 82-4) in the group based on the token secret and the 
password. 
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33. The system of claim 25, characterized in that the means for determining 
the check token in turn comprises 

means for retrieving, at the first unit (32-1; 42-1; 52-2; 92-1), the token 
secret using the authentication token of the first unit and the password; and 
5 means for creating, at the first unit, the check token for the second unit 

(32-2; 42-2; 52-1, 52-3, 52-4; 92-4) based on the token secret and the 
password. 

34. The system of claim 32 or 33, characterized in that the means for 
10 creating involves a bijective locking function, the input parameters of which 

include the token secret and a one-way function of the password. 

35. The system of claim 25, characterized by policies implemented in at least 
one of the units in the group for limiting the number and /or frequency of 

15 authentication attempts. 

36. The system of claim 25, characterized by further comprising means for 
generating an alarm signal if the number of authentication attempts exceeds 
a predetermined value. 

20 

37. The system of claim 25, characterized by further comprising means for 
sending an authentication response message (34; 44; 94) from the second 
unit (34-2; 42-2; 92-4). 

25 38. The system of claim 25, characterized by further comprising means for 
mutual authentication between two units (12; 22; 32; 42; 52; 72; 82; 92) in 
the group. 

39. The system of claim 25, characterized by policies defining critical 
30 operations for which authentication is needed. 

40. The system of claim 25, characterized by being a Personal Area Network 
(PAN). 
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41. A device (12; 22; 32; 42; 52; 72; 82; 92) belonging to a group (100) of at 
least two devices associated with a common password, and comprising means 
for password-based authentication, characterized in that this first device 

5 comprises: 

means for receiving a password; 

means for assigning individual authentication tokens to other devices (72- 
2, 72-3; 82-4) in the group based on the password such that each 
authentication token is irreversibly determined by the password; 
10 means for determining a check token for a second device (32-2; 42-2; 52- 

1, 52-3, 52-4; 92-4) in the group based on the password and the 
authentication token of the first device (32-1; 42-1; 52-2; 92-1); and 

means for transmitting the check token to the second device for 
authentication towards the second device. 

15 

42. The device of claim 41, characterized by further comprising 

means for deleting the password and parameters generated in the 
authentication procedure except the authentication token after usage thereof. 

20 43. The device of claim 41, characterized by further comprising 

means for creating update information for the second device (42-2; 52-1, 
52-3, 52-4; 92-4); and 

means for securely transferring update information to the second device. 

25 44. The device of claim 43, characterized by means for delegation of update 
rights to an intermediate device (92-2, 92-3), and means for sending update 
information for the second device (92-4) to the intermediate device. 

45. The device of claim 41, characterized in that the means for assigning in 
30 turn comprises 

means for determining a token secret common for the group (100) and 
non-correlated with the password; and 
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means for creating the authentication token for another device (72-2, 72- 
3; 82-4) in the group based on the token secret and the password, 

46. The device of claim 41, characterized in that the means for determining 
5 the check token in turn comprises 

means for retrieving the token secret using the authentication token of 
the first device (32-1; 42-1; 52-2; 92-1) and the password; and 

means for creating the check token for the second device (32-2; 42-2; 52- 
1, 52-3, 52-4; 92-4) based on the token secret and the password. 

10 

47. A computer program product for, when executed by a computer, 
password-based authentication in a communication system comprising a 
group (100) of at least two units (12; 22; 32; 42; 52; 72; 82; 92) associated 
with a common password, characterized by 

15 program means for assigning individual authentication tokens to the 

respective units of the group based on the password such that each 
authentication token is irreversibly determined by the password; 

program means for determining, at a first unit (32-1; 42-1; 52-2; 92-1), a 
check token for a second unit (32-2; 42-2; 52-1, 52-3, 52-4; 92-4) based on 
20 the password and the authentication token of the first unit; and 

program means for comparing, at the second unit, the check token with 
the authentication token of the second unit for authentication of the first unit 
towards the second unit. 



25 
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